811616 - "Assertion failure: [infer failure] Missing type pushed 0: string," or "Assertion failure: [infer failure] Missing type pushed 0: int,"

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

"".replace(RegExp(), Array.reduce)

asserts js debug shell on m-c changeset 4e9567eeb09e with --ion-eager at Assertion failure: [infer failure] Missing type pushed 0: string,

s-s and assuming sec-critical because this is an type inference failure, which is usually bad. Setting fuzzblocker because this is blowing up the fuzzers.

See bug 811606 and bug 811612.

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   113105:3da143341145
user:        Till Schneidereit
date:        Tue Aug 28 14:35:15 2012 +0200
summary:     Bug 784294 - Convert some array extras to self-hosted js implementations. r=Waldo

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack for second assertion

This may also be related:

[0,0].sort(Array.reduce,RegExp())

Assertion failure: [infer failure] Missing type pushed 0: int,

Comment 2

[Christian Holler (:decoder)]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision dd68409d7810).

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Bug 784294 was backed out in https://hg.mozilla.org/mozilla-central/rev/dd68409d7810 - "fixing" this.

Till, please add this testcase to future revised patches.

Comment 4

[Christian Holler (:decoder)]

JSBugMon: This bug has been automatically verified fixed.

Comment 5

[Till Schneidereit [:till]]

I think we can make this public, as the causing code never made a Nightly.

Comment 6

[Christian Holler (:decoder)]

Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929